Encryption Key Protection

Abstract

Aspects of the present invention include generating a cryptographic key for restricting access to a resource. The cryptographic key is defined by a key token. An exemplary method includes specifying a storage field within the metadata of the key token, within the metadata of a cryptographic key data set record that includes the key token, or within a resource access control database that controls use of the cryptographic key to include an indicator of whether the cryptographic key can or cannot be deleted or modified. The indicator within the specified storage field is set to indicate whether the cryptographic key can or cannot be deleted or modified.

Description

[Technical field]

[0001] The present invention relates generally to cryptographic keys, and more particularly to protecting cryptographic keys from modification or deletion. [Background technology]

[0002] Encryption keys are used to encrypt data to prevent intrusion and comply with industry regulations. Data encryption keys (or encryption keys) are used to read and write encrypted data, which is data that has been modified by an encryption algorithm according to a key. A key is a data string that defines the functional output of the algorithm. Data can be read and written using the same encryption key or different encryption keys. Encryption keys can be designed as single-use keys or long-term keys. Summary of the Invention

[0003] An embodiment of the present invention is directed to protecting cryptographic keys from modification or deletion. According to one aspect of the present invention, a computer-implemented method is provided that includes generating a cryptographic key for restricting access to a resource. The cryptographic key is defined by a key token. The method further includes specifying a designated storage field in metadata of the key token, in a cryptographic key data set record that includes the key token, or in a resource access control database that controls use of the cryptographic key, to include an indicator of whether the cryptographic key can or cannot be deleted or modified. The indicator in the designated storage field is set to indicate whether the cryptographic key can be deleted or modified.

[0004] Other embodiments of the present invention embody the functionality of the above methods in computer systems and computer program products.

[0005] Additional technical features and advantages are realized through the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered a part of the claimed subject matter. For a better understanding, reference should be made to the detailed description and drawings. [Brief description of the drawings]

[0006] The particular subject matter of the exclusive rights described herein is particularly pointed out and distinctly claimed in the claims concluding portion of this specification. The foregoing and other features and advantages of embodiments of the present invention will become apparent from the following detailed description, taken in conjunction with the accompanying drawings.

[0007] [Figure 1] 1 illustrates an exemplary fixed-length key token with exemplary designated storage fields for protecting cryptographic keys from modification or deletion in accordance with one or more embodiments of the present invention.

[0008] [Diagram 2] 1 illustrates an exemplary Cryptographic Key Data Set (CKDS) that stores key records with designated storage fields to protect cryptographic keys from modification or deletion in accordance with one or more embodiments of the present invention.

[0009] [Diagram 3] 1 illustrates an exemplary resource access control database having designated storage fields associated with each cryptographic key for protection against modification or deletion in accordance with one or more embodiments of the present invention.

[0010] [Figure 4] 1 illustrates a block diagram of a processing system for storing and processing the designated storage fields described herein.

[0011] The diagrams shown herein are exemplary. There may be many variations in the diagrams or operations described herein that do not depart from the scope of the invention. For example, acts may be performed in a different order, or acts may be added, removed, or modified. Additionally, the term "coupled" and variations thereof thus describe having a communication path between two elements, and do not imply a direct connection between the elements with no intervening elements / connections between them. All these variations are considered part of this specification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] As mentioned above, encryption keys facilitate the generation of encrypted data from input data. The encryption key is required to recover the input data from the encrypted data. Without the correct encryption key, the encrypted data is unintelligible. While encryption keys for certain applications can be single-use keys, others are long-term keys. Long-term keys may need to be retained for decades. Depending on the length of time encryption keys need to be retained, concerns arise regarding inadvertent or malicious deletion or alteration of encryption keys.

[0013] One conventional approach involves allowing an administrator to track the usage of encryption keys to determine if the keys are still in use. However, a given encryption key may protect data that was encrypted before tracking was available, or data that is currently stored and offline and appears to be unused. In this case, tracking usage does not adequately ensure retention of the encryption key. Another approach involves the generation of a public / private key pair (i.e., a key-encrypting key) to protect the encryption key. The encryption key is retained as long as the key-encrypting key is persisted. However, this approach adds another key that must be tracked.

[0014] One or more embodiments of the present invention relate to protecting cryptographic keys from modification or deletion. Specifically, a storage field is established that is directly related to the cryptographic keys that must be preserved. As further detailed herein, the storage field may be part of a key token, which is the metadata for the cryptographic key itself. According to another embodiment of the present invention, the storage field may be part of the metadata for a key storage entry that contains the key token. According to yet another alternative embodiment of the present invention, the storage field may be part of a resource access control database that controls how the cryptographic keys may be used. According to one exemplary embodiment of the present invention, once a storage field is established that specifies that a key is permanent or protected, a program or application program interface (API) that provides access to the cryptographic keys will issue a failure to a request to modify or delete the cryptographic key.

[0015] FIG. 1 illustrates an exemplary fixed-length key token 110 with an exemplary designated storage field 120 for protecting the encryption key 100 from modification or deletion, according to one or more embodiments of the present invention. As previously described, the encryption key 100 may be used to control access to resources (e.g., programs, data). Attempts to access resources encrypted by the encryption key 100 will fail if the correct encryption key 100 is not used. A key token 110 defining the encryption key 100 may be generated and stored, for example, in memory 19 of a processing system 400 shown in FIG. 4. The exemplary key token 110 is shown having a fixed length of 64 bytes, represented by 128 hexadecimal characters. Other lengths are possible for the key token 110. The key token 110 is generated by an API or programmatically based on the specifications of the desired encryption key 100, and is metadata for the encryption key 100 itself. An exemplary description of the 64 bytes is provided in Table 130. 1, the byte at offset 5 is shown as an exemplary designated storage field 120 that indicates that the cryptographic key 100 cannot be deleted or altered. In alternative embodiments of the invention, other bytes (e.g., bytes 1-3) may be used for the designated storage field 120.

[0016] When the cryptographic key 100, i.e., the key token defining the cryptographic key 100, is generated, when the cryptographic key 100 is imported, or at any other time, an indicator that the cryptographic key 100 cannot be deleted or modified can be added to the designated storage field 120. When an attempt is made to delete or overwrite the cryptographic key 100, the designated storage field 120 is checked for containing the indicator. If the indicator has in fact been created in the designated storage field 120, the attempt to delete or overwrite the cryptographic key 100 will fail. The indicator can be, for example, a flag (0=can be deleted or modified, 1=cannot be deleted or modified). Optionally, the key token 110 can be stored as part of a key record 230 in a data set (e.g., the cryptographic key data set (CKDS) 210) as described with reference to FIG. 2.

[0017] FIG. 2 illustrates an exemplary CKDS 210 that stores key records 230 having a designated storage field 240 for protecting the cryptographic key 100 (FIG. 1) from modification or deletion, in accordance with one or more embodiments of the present invention. The CKDS 210 may be stored, for example, in memory 19 of a processing system 400 (FIG. 4). In FIG. 2, the exemplary CKDS 210 is shown to store key labels 220a, 220b (collectively referred to as 220). Each key label 220a, 220b is an index for a corresponding key record 230a, 230b (collectively referred to as 230). Each key record 230 includes a key token 110 (FIG. 1) and metadata. Table 235 details the fields that make up the key record 230. As illustrated in FIG. 2, the metadata may include a designated storage field to which an indication may be added that the cryptographic key 100 identified by the corresponding key label 220 cannot be deleted or altered.

[0018] An indication that the cryptographic key 100 cannot be deleted or modified can be added to the designated storage field when the particular key record 230 is created, when the key record 230 is populated after obtaining the key token 110 that defines the cryptographic key 100, or at any other time. As mentioned for the designated storage field 120 described with reference to FIG. 1, when an attempt is made to delete or overwrite the cryptographic key 100, the designated storage field 240 is checked for containing an indication (that the corresponding cryptographic key cannot be deleted or modified). If the indication has in fact been created in the designated storage field 240, the attempt to delete or overwrite the cryptographic key 100 will fail. The indication can be, for example, a flag (0=can be deleted or modified, 1=cannot be deleted or modified).

[0019] As previously discussed, storing key token 110 as part of key record 230 is optional. Thus, in accordance with an exemplary embodiment of the present invention, key token 110 may be stored by itself with designated storage field 120. Alternatively, key token 110 with designated storage field 120 may be stored in key record 230. In accordance with yet another alternative embodiment of the present invention, key token 110 may be stored in key record 230 that includes designated storage field 240.

[0020] 3 illustrates an exemplary resource access control database 305 having designated storage fields associated with each cryptographic key 100 for protection against modification or deletion in accordance with one or more embodiments of the present invention. The resource access control database 305 includes profiles 315a-n (collectively referred to as 315) corresponding to cryptographic keys 100a-n (collectively referred to as 100), respectively. As previously discussed, each cryptographic key 100 may be defined, for example, by a key token 110 (FIG. 1). As further noted with respect to FIG. 2, the CKDS 210 may store key records 230a-n (collectively 230) corresponding to keys 100a-n.

[0021] As described with respect to FIG. 1, the metadata of the key token 110 defining the cryptographic key 100 can include the designated storage field 120. As described with respect to FIG. 2, the metadata of the key record 230 can include the designated storage field 240. Alternatively, the metadata of the key token 110 that is part of the key record 230 can include the designated storage field 120. As FIG. 3 shows, the profile 315 in the resource access control database 305 corresponding to each cryptographic key 100 can include the designated storage field 310. The security controls stored in the profile 315 in the resource access control database 305 that direct the use of the corresponding cryptographic key 100 can be implemented, for example, by the processor 21 of the processing system 400 (FIG. 4). The profiles 315, each including the designated storage field 310, can be stored in the memory 19 of the processing system 400.

[0022] The command used to set the fields of a profile 315 in the resource access control database 305 can also be used to set an indicator in the designated storage field 310 corresponding to any number of cryptographic keys 100 associated with the resource access control database 305. That is, an indicator in one, a set, or all of the designated storage fields 310 of a profile 315 can be set with a single command. This indicator can be added to the designated storage field 310 at any time. This indicator can be, for example, a flag (0=can be deleted or modified, 1=cannot be deleted or modified). When an attempt is made to delete or overwrite a cryptographic key 100 associated with a profile 315, the designated storage field 310 of the profile 315 is checked for including an indicator that the cryptographic key 100 cannot be deleted or modified. If an indicator has actually been created in the designated storage field 310, the attempt to delete or overwrite the cryptographic key will fail.

[0023] FIG. 4 illustrates a block diagram of a processing system 400 for storing and processing designated storage fields 120, 240, 310 as described herein. In the embodiment illustrated in FIG. 4, the processing system 400 has one or more central processing units (processors) 21a, 21b, 21c, etc. (collectively or generally referred to as processor(s) 21 or processing device(s) or both). According to one or more embodiments of the present invention, each processor 21 may include a reduced instruction set computer (RISC) microprocessor. The processors 21 are coupled to system memory (e.g., random access memory (RAM) 24) and various other components via a system bus 33. A read only memory (ROM) 22 is coupled to the system bus 33 and may include a basic input / output system (BIOS) that controls certain basic functions of the processing system 400.

[0024] Also shown are an input / output (I / O) adapter 27 and a communication adapter 26 coupled to the system bus 33. The I / O adapter 27 may be a small computer system interface (SCSI) adapter that communicates with a hard disk 23 or a tape storage drive 25, or both, or any other similar components. The I / O adapter 27, the hard disk 23, and the tape storage drive 25 are collectively referred to herein as mass storage 34. An operating system 40 for execution on the processing system 400 may be stored in the mass storage 34. The RAM 22, the ROM 24, and the mass storage 34 are examples of memory 19 of the processing system 400. The network adapter 26 interconnects the system bus 33 with an external network 36, allowing the processing system 400 to communicate with other such systems.

[0025] A display (e.g., a display monitor) 35 is connected to the system bus 33 by a display adapter 32, which may include a graphics adapter and a video controller for improving performance of graphics-intensive applications. According to one or more embodiments of the present invention, adapters 26, 27 and / or 32 may be connected to one or more I / O buses connected to the system bus 33 through an intermediate bus bridge (not shown). Suitable I / O buses for connecting peripheral devices such as hard disk controllers, network adapters and graphics adapters typically include common protocols such as Peripheral Component Interconnect (PCI). Additional input / output devices are shown connected to the system bus 33 through a user interface adapter 28 and a display adapter 32. A keyboard 29, a mouse 30 and speakers 31 may be interconnected to the system bus 33 through a user interface adapter 28, which may include, for example, a super I / O chip that integrates multiple device adapters within a single integrated circuit.

[0026] In accordance with one or more embodiments of the present invention, processing system 400 includes a graphics processing unit 37. Graphics processing unit 37 is a specialized electronic circuit designed to manipulate and modify memory to accelerate the creation of images in a frame buffer intended for output to a display. In general, graphics processing unit 37 is very efficient at manipulating computer graphics and image processing, and has a highly parallel structure that makes it more efficient than a general purpose CPU for algorithms in which the processing of large blocks of data is done in parallel.

[0027] Thus, as configured herein, processing system 400 includes processing capability in the form of processor 21, storage capabilities including system memory (e.g., RAM 24) and mass storage 34, input means such as keyboard 29 and mouse 30, and output capabilities including speaker 31 and display 35. In accordance with one or more embodiments of the present invention, a portion of the system memory (e.g., RAM 24) and mass storage 34 collectively store an operating system, such as the AIX® operating system by IBM, which coordinates the functionality of the various components illustrated in processing system 400.

[0028] Various embodiments of the present invention are described herein with reference to the associated drawings. Alternative embodiments of the present invention may be devised without departing from the scope of the present invention. In the following description and drawings, various connections and relationships between elements (e.g., above, below, adjacent, etc.) are made clear. These connections or relationships, or both, may be direct or indirect unless otherwise specified, and the present invention is not intended to be limited in this respect. Thus, coupling of entities may refer to either direct or indirect coupling, and relationships between entities may be direct or indirect. Additionally, various tasks and process steps described herein may be combined into a more comprehensive procedure or process having additional steps or functionality not described in detail herein.

[0029] One or more of the methods described herein may each be implemented using any one or combination of the following technologies known in the art: discrete logic circuit(s) having logic gates for performing logical functions on data signals, application specific integrated circuits (ASICs) having appropriate combinatorial logic gates, programmable gate array(s) (PGAs), field programmable gate arrays (FPGAs), etc.

[0030] For the sake of brevity, prior art techniques relating to making or using aspects of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Thus, for the sake of brevity, many conventional implementation details are only briefly mentioned herein or omitted altogether, without providing details of well-known systems or processes or both.

[0031] In some embodiments, various functions or actions may be performed at or in connection with the operation of one or more device or system locations, or both. In some embodiments, a portion of a given function or action may be performed at a first device or location, and a remainder of the function or action may be performed at one or more additional devices or locations.

[0032] The terms used herein are for the purpose of describing particular embodiments only and are not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural unless the context clearly indicates otherwise. Furthermore, it will be understood that the terms "comprise" and / or "comprising" as used herein specify the presence of stated features, integers, steps, operations, elements or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components or groups, or combinations thereof.

[0033] The corresponding structures, materials, acts, and equivalents of any "means or step plus function" elements in the following claims are intended to include any structure, material, or act for performing a function in conjunction with other claimed elements as specifically claimed. The present disclosure has been presented for purposes of illustration and description only, and is not intended to be exhaustive or limited to the disclosed form. Numerous modifications and variations will be apparent to those skilled in the art that do not depart from the scope of the present disclosure. The embodiments have been chosen and described in order to best explain the principles and practical applications of the present disclosure, and to enable those skilled in the art to understand the present disclosure in terms of various embodiments with various modifications as suited to the particular applications contemplated.

[0034] The diagrams shown herein are illustrative. There may be many variations to the diagrams or steps (or operations) described therein without departing from the scope of the present disclosure. For example, actions may be performed in a different order, or actions may be added, deleted, or modified. Also, the term "coupled" describes having a single path between two elements, and does not imply a direct connection between elements with no intervening elements / connections between them. All of these variations are considered part of the present disclosure.

[0035] The following definitions and abbreviations are used in interpreting the claims and the specification. As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," "contains," or "containing," or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or device that includes a list of elements is not necessarily limited to only those elements, but can include other elements not expressly listed or that are inherent in such composition, mixture, process, method, article, or device.

[0036] Moreover, the term "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" can be understood to include any integer greater than or equal to one, i.e., 1, 2, 3, 4, etc. The term "multiple" can be understood to include any integer greater than or equal to two, i.e., 2, 3, 4, 5, etc. The term "connected" can include both indirect and direct "connections."

[0037] The terms "about," "substantially," "approximately," and variations thereof are intended to include the degree of error associated with the measurement of a particular quantity, based on the equipment available at the time of this application. For example, "about" can include a range of ±8%, or 5%, or 2% of a given value.

[0038] The present invention may be embodied as a system, method, or computer program product, or combination thereof, at any possible level of technical detail. The computer program product may include one or more computer readable storage media having computer readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0039] A computer readable storage medium may be any tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves having instructions recorded thereon, and any suitable combination of the above. As used herein, a computer-readable storage medium is not to be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses through a fiber optic cable), or an electrical signal sent through a wire.

[0040] The computer readable program instructions described herein can be downloaded from a computer readable storage medium to each computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network can include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions for storage in a computer readable storage medium in the respective computing / processing device.

[0041] The computer readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as the "C" programming language, or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partly on the user's computer as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on a remote computer or server. In the last scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can use state information of the computer readable program instructions to execute the computer readable program instructions by individualizing the electronic circuitry to perform aspects of the present invention.

[0042] Aspects of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0043] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, whereby the instructions executed by the processor of the computer or other programmable data processing apparatus create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer readable storage medium having instructions stored therein includes an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0044] The computer program instructions may be loaded onto a computer, other programmable data processing apparatus, or other device to cause a sequence of operational acts to be performed on the computer, other programmable data processing apparatus, or other device to generate a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0045] The flowcharts and block diagrams in the figures illustrate the architecture, functionality and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment or part of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions shown in the blocks may occur in a different order than that shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or these blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that executes the specified functions or operations, or executes a combination of dedicated hardware and computer instructions.

[0046] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used in this specification are selected to best explain the principles, practical applications, or technical improvements of the embodiments over the art found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. generating, with a processor, a cryptographic key for limiting access to a resource defined by a key token; using said processor to specify a storage field in metadata of said key token, in metadata of a cryptographic key data set record containing said key token, or in a resource access control database that controls use of said cryptographic key, for including an indication of whether said cryptographic key may or may not be deleted or modified; using said processor to set in said designated storage field said indicator indicating whether said encryption key may be deleted or changed; Including, the resource access control database includes two or more profiles corresponding respectively to two or more of the encryption keys, each of the two or more profiles having the designated storage field, and setting the indicator in the designated storage field includes simultaneously setting the indicator in the designated storage field of each of the two or more profiles; A computer-implemented method.

2. 2. The computer-implemented method of claim 1, further comprising storing the cryptographic key data set record in a cryptographic key data set.

3. 3. The computer-implemented method of claim 2, wherein specifying the storage field comprises the storage field being within the metadata of the key token that is part of the cryptographic key data set record.

4. 2. The computer-implemented method of claim 1, wherein setting the indicator comprises setting a flag having a value of 0 or 1 that indicates whether the cryptographic key can be deleted or changed.

5. The computer-implemented method of claim 1 , wherein generating the encryption key for restricting access to the resource comprises generating the encryption key for restricting access to a program or data.

6. a memory having computer readable instructions; one or more processors for executing the computer readable instructions; Equipped with The computer readable instructions control the one or more processors to: generating a cryptographic key for restricting access to a resource defined by a key token; specifying a storage field within the metadata of said key token, within the metadata of a cryptographic key data set record containing said key token, or within a resource access control database that controls use of said cryptographic key, to include an indication of whether said cryptographic key may or may not be deleted or modified; setting the indicator in the designated storage field indicating whether the encryption key may be deleted or changed; Perform an action including the resource access control database includes two or more profiles corresponding respectively to two or more of the encryption keys, each of the two or more profiles having the designated storage field, and setting the indicator in the designated storage field includes simultaneously setting the indicator in the designated storage field of each of the two or more profiles; system.

7. 7. The system of claim 6, further comprising storing the cryptographic key data set record in a cryptographic key data set.

8. 8. The system of claim 7, wherein specifying the storage field comprises the storage field being within the metadata of the key token that is part of the cryptographic key data set record.

9. The system of claim 6 , wherein setting the indicator comprises setting a flag having a value of 0 or 1 indicating whether the cryptographic key can be deleted or changed.

10. The system of claim 6 , wherein generating the encryption key for restricting access to the resource comprises generating the encryption key for restricting access to a program or data.

11. A computer program comprising program instructions causing a computer to carry out the method according to any one of claims 1 to 5.

12. A computer readable storage medium having stored thereon the computer program product of claim 11.

Images